Object Detection Verification Against Adversarial Patch Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing object detection systems are vulnerable to adversarial example patch attacks that obstruct accurate detection by physically placing perturbation images, which current methods fail to effectively detect and counter.
Innovation Solution
An image processing device that performs object detection on both the original and painted-out images to calculate bounding boxes and score values, determining the presence of an adversarial example patch by comparing score differences before and after painting out bounding boxes, and outputs a detection flag and candidate bounding boxes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If object detection is performed on a subject image using deep learning, then high detection accuracy is achieved, but the system becomes vulnerable to adversarial example patch attacks that can obstruct detection
Solution Approach 1:
The system performs preliminary object detection on the original subject image to identify candidate objects and their bounding boxes before the adversarial patch can fully interfere. This initial detection creates a reference state that can be compared against subsequent detections on modified images, enabling the system to detect anomalies caused by adversarial patches.
Solution Approach 2:
The system introduces an intermediary verification process that detects painted-out regions (adversarial patches) by comparing detections across multiple images. This intermediary detection layer acts as a mediator between the original image and the final detection result, identifying and filtering out detections that are likely caused by adversarial manipulation.
2Reliability
If the system processes multiple images (original and painted-out versions) to detect attacks, then attack detection capability is improved, but processing time and computational complexity increase
Solution Approach 1:
The system segments the attack detection process into distinct stages: first detecting objects in the original image, then detecting objects in painted-out versions, and finally comparing results to identify adversarial patches. This segmentation allows the system to process images in manageable steps rather than requiring complete re-processing of all images simultaneously, reducing overall computational burden.
Solution Approach 2:
The system applies partial processing by only painting out and re-detecting in regions where objects were initially detected, rather than processing entire images. This partial action approach focuses computational resources only on relevant regions, significantly reducing processing time while maintaining effective attack detection capability.
Data Source
AI summary
A first detection unit (121) executes object detection for a subject image. A processing unit (130) generates a painted-out image per bounding box of the subject image by painting out the bounding box of the subject image. A second detection unit (122) executes, per painted-out image, object detection for the painted-out image. A determination unit (140) determines whether an adversarial example patch attack has been conducted, on a basis of a score value of each bounding box of the subject image and a score value of each bounding box of a painted-out image group.